1. Field of the Invention
The present invention is in the field of cryptographic methods for establishing a cryptographic link for communication of information between elements of a system. In particular, the present invention relates to a system and method for exchanging cryptographic keys between elements in a system to create a cryptographic network where each element of the system authenticates the other elements of the system with which it will communicate.
2. Description of the Related Art
A cryptographic system typically involves the application of an encryption algorithm to a plain text message to create cipher text, which cannot be understood without performing a corresponding decryption function. A relatively simple cryptosystem utilizes the same algorithm for both encryption and decryption functions. Using such a system requires that the algorithm be disseminated to elements of the system, without disclosing the algorithm to outsiders.
A slightly more sophisticated cryptographic system will typically involve an algorithm that operates on a key to encrypt or decrypt messages, so that an outsider cannot decrypt a message without determining both the algorithm and the key. In such a system, selecting a new key is typically much easier than selecting a new algorithm. Thus, if the security of the system has been compromised, a secure path can be reestablished by securely transferring a new key, without having to develop a new algorithm. Hence, the security of the system does not rely on the privacy of the algorithm. A cryptosystem of this type will be referred to as a private key cryptosystem. One such system, the xe2x80x9cDESxe2x80x9d system, is disclosed in the xe2x80x9cData Encryption Standard,xe2x80x9d Federal Information Processing Standards Publication No. 46, Jan. 15, 1977, which is incorporated herein by reference. Use of these private key systems, however, still requires that a key be privately communicated between elements of the system, which typically requires costly and time-consuming measures to ensure that outsiders do not intercept a message containing a new key.
A public key cryptosystem provides a secure link without having to privately transfer keys among elements of the system. Such a system involves a pair of inverse transformations for encrypting and decrypting a message. Applying one of the transformations to ciphertext that has been encrypted by the other transformation will yield the original plain text message. Again, each of the transformations can involve the application of a common algorithm to a unique key to provide a unique transformation. Thus, a first algorithm and a first key combine to form a first transformation, while a second algorithm and a second key form a second transformation, where the two transformations are inverse functions.
In a public key cryptosystem, each element in the system will have a pair of keys that, along with the appropriate algorithms, provide the inverse functions of encryption and decryption. One of the keys, the public key, is distributed to other elements in the system, without taking any measures to prevent outsiders from acquiring the key. The other key, the private key, is retained by the element to which the keys belong, and this key should not be disclosed for any reason. Thus, neither of the keys have to be privately communicated to other elements of the system. The algorithms and keys used in such a cryptosystem must be selected to render infeasible the determination of a private key, based on knowledge of the corresponding public key. The prior art discloses several thoroughly tested public key cryptosystems that meet these requirements. For example, U.S. Pat. No. 4,405,829, issued to Rivest, et al., which is hereby incorporated by reference, discloses a well-known public key cryptosystem commonly referred to as the RSA cryptosystem.
To further explain the use of a public key cryptosystem, suppose that elements A and B desire to establish a secure link. Element A will generate a public/private key pair, transmit the public key to element B, and retain the private key to itself. Element B will generate its own public/private key pair, transmit its public key to element A, and retain its own private key. If element A now wants to send a private message to element B, element A will encrypt a plaintext message using the public key of element B. The resulting ciphertext can only be decrypted by using element B""s private key. Because only element B has this private key, only element B can decrypt the ciphertext to obtain the original message. In the same manner, element B can send a private message to element A by encrypting the message with element A""s public key. Thus, elements A and B have established a secure link by swapping public keys.
The above description of the use of a public key cryptosystem allows for private transfer of messages between elements of a system. Another use of a public key cryptosystem allows elements of a system to verify the source of a message. In the above example, if element A encrypts a message with its own private key and sends the message to element B, then element B can verify that the message came from element A by applying A""s public key to decrypt the message. Any message that can be decrypted using A""s public key must have been encrypted by A because only A has the corresponding private key. This use of a public key cryptosystem is called a digital signature system. Several public key cryptosystems have been developed specifically for this purpose. For example, the Digital Signature Standard (DSS), which is published by the National Institute of Standards and Technology (FIPS PUB XX, Feb. 1, 1993), describes one such system. The DSS is also incorporated by reference.
The two uses of public key cryptosystems described above can be referred to as xe2x80x9cprivacyxe2x80x9d and xe2x80x9cauthentication,xe2x80x9d respectively. Both of these uses are subject to an important limitation. The privacy and authentication objectives can only be achieved if an element obtains the correct public key for the element with which it wishes to communicate. In the example described above, an outsider X may pretend to be a true element of the system, element C for example, and send a public key to element A. Element A, believing the outsider to be element C, may send its public key to the outsider X. Then, if element A intends to send a private message to element C, element A will encrypt the plaintext message using the public key of the outsider X, believing it to be the public key of element C. Element A will then transmit the ciphertext to the outsider X, again believing the outsider X to be element C. Thus, the outsider can simply apply its own private key to decipher the cipher text. In addition, outsider X can sign a message with its own private key and send the message to element A. Element A will apply the public key of outsider X, believing it to be the public key of element C. Because the keys will correspond, element A will believe that the message was signed by element C.
One solution to the above-described problem with public key cryptosystems involves the use of certificates generated by a mutually trusted authority. In the example described above, assume that each of the elements of the system will trust an authority T to recognize the different elements of the system. Each of the elements of the system can become authenticated by the authority T. To obtain authentication, element A will provide its public key to the authority T. After verifying that the public key belongs to element A, the authority T will sign, using its own private key, a message containing the public key of element A. The authority T will then provide this signed message, in the form of a certificate, to element A. Element A can now provide the certificate to other elements of the system to prove that its public key was recognized by the authority T.
When attempting to establish a secure link with another element, for example, element B, element A will transmit the certificate to element B. Element B will use the public key of the authority T to decrypt the certificate and verify the public key of element A. Now, as long as element B can trust the decision by authority T to authenticate the public key of element A, element B can trust the results of using the public key of element A for privacy and authentication functions. However, if element B does not have the true public key of the authority T, then the security of the system may also be compromised. This is an important weakness in many existing cryptosystems.
In theory, a private key cryptosystem can serve the functions of privacy and authentication very well. However, in practice, many implementations of these systems have been compromised. Pirates are often very sophisticated and will often go to great lengths to break into a cryptosystem. Many implementations of cryptographic systems have utilized expensive security measures to safeguard against pirates. For example, systems are often set up to require that two specific people be present simultaneously to perform certain sensitive functions. In many situations, however, such security measures would be prohibitively expensive. Consequently, many systems for which the market does not justify such expenditures are vulnerable to pirate attacks.
In addition, a public key cryptosystem will only be secure, even in theory, if computing a private key, based on knowledge of a corresponding public key, is computationally infeasible. Although the prior art discloses several systems that have been thoroughly tested, and appear to satisfy this requirement, these systems also require substantial processing capabilities to originally generate a public/private key pair. Providing the required processing capabilities can again be prohibitively expensive, especially when a large number of public key pairs is required for a large number of units in a system. There is a need in the cryptography industry for a secure, but relatively inexpensive cryptographic system.
One embodiment of the invention includes a hierarchical cryptographic system having distributed authority among different classes of units in the system. The system may comprise a trusted authority, a first unit authorized by the trusted authority to distribute public and private signature and encryption keys, and a second unit having a read only memory and a programmable processor. The read only memory may store a public signature key of the trusted authority and a verification program. The second unit accepts for use one or more of the keys only after the programmable processor performs the verification program using the public signature key of the trusted authority, whereby the programmable processor verifies that the first unit has been authorized to distribute public and private signature and encryption keys. The first and second units may in some specific embodiments comprise elements of a subscriber television system, or may comprise elements of a computer network.
In another embodiment, the invention comprises a unit of a cryptographic system having a processor and a read only memory. The read only memory has stored therein a verification program which includes a public signature key of a trusted authority. The processor is operative under the direction of the verification program to analyze the authenticity of certificates received by the unit. In addition, the verification program is made a permanent part of the read only memory during the formation process of the read only memory prior to the application of electrical power to the read only memory. In some specific embodiments, the unit may comprise an access control device, or an element of a computer network.